Privacy policy
How Segna collects and protects your data
This English version is a translation provided for convenience only. In the event of any discrepancy, the French version prevails. Version dated 15 October 2026.
1. Data controller
Segna, SASU, RCS Paris 941 271 801, 60 rue François 1er, 75008 Paris, is the data controller for the processing described here. Contact for any question relating to data: privacy@segnashare.com.
2. Data collected
| Category | Details |
|---|---|
| Identity and contact details | Data: first name, surname, e-mail, mobile number, date of birth, delivery and billing addresses, VAT number for a business — Source: provided at sign-up and when ordering |
| Profile and preferences | Data: photo, bio, town or neighbourhood, occupation, Instagram / TikTok / Pinterest handles, sizes, favourite brands and styles, onboarding answers — Source: provided by the User |
| Content | Data: looks (photos, videos), inspirations, accounts followed, chat messages with Segna, dispute photos — Source: provided by the User |
| Orders and payment | Data: bags, orders, shipments, returns, invoices, disputes, compensation, Stripe customer ID, last 4 digits of the card — Source: generated through use; only Stripe holds the card data |
| Identity verification | Data: result of the Stripe Identity verification, document type; the images are processed by Stripe — Source: Stripe Identity (Club+) |
| Usage and technical data | Data: pages and screens viewed, interactions with pieces, feed impressions, sessions (IP address, browser), notification tokens, device identifier, app version — Source: collected automatically |
| Consents | Data: privacy choices, communication preferences and their history — Source: provided by the User |
Segna does not collect continuous geolocation, contacts or sensitive data. The address is used for delivery; only the neighbourhood may appear on the public profile.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, authentication (e-mail and SMS OTP, Apple, Google) | performance of the contract |
| Processing orders, memberships, deliveries, returns, invoices | performance of the contract |
| Verifying the identity of Club+ members | legitimate interest (prevention of fraud and of failures to return) |
| Managing late returns, damage, disputes, debt recovery, formal notices | performance of the contract and legitimate interest |
| Displaying profiles, looks and the community | performance of the contract; consent for profile visibility |
| Personalising the catalogue and recommendations | consent (‘personalisation’ setting) |
| Sending service messages (e-mail, push, SMS) | performance of the contract |
| Sending news and offers (e-mail, push) | consent, which can be withdrawn at any time |
| Measuring audience and improving the product (PostHog, Google Analytics) | consent on the website; legitimate interest in the app |
| Advertising and campaign measurement (Meta Pixel) | consent |
| Customer support via chat | performance of the contract |
| Accounting, legal obligations, litigation | legal obligation and legitimate interest |
4. Recipients and processors
The data is accessible to authorised Segna team members and is passed on to the following service providers, solely for the purposes indicated:
| Service provider | Details |
|---|---|
| Supabase | Role: database, authentication, media storage — Location: EU (Ireland) |
| Vercel | Role: hosting of the website and APIs — Location: United States (standard contractual clauses) |
| Stripe | Role: payment, invoices, identity verification — Location: Ireland / United States |
| Sendcloud, Mondial Relay, Chronopost | Role: labels, shipping, pickup points — Location: EU |
| Resend | Role: sending e-mails — Location: United States |
| Twilio | Role: sending verification and tracking SMS messages — Location: United States |
| Expo | Role: push notifications — Location: United States |
| Apple, Google | Role: authentication, notifications, Apple Pay / Google Pay — Location: United States |
| PostHog | Role: usage analytics and session recording (fields masked) — Location: EU (Frankfurt) |
| Google Analytics, Cookiebot | Role: audience measurement, consent management (website) — Location: United States / EU |
| Meta | Role: advertising pixel (website, with consent) — Location: United States |
| AR24 | Role: registered electronic letters in the event of failure to return — Location: France |
| Discord, n8n | Role: internal support tools (chat messages relayed to the team) and automation tools — Location: United States (Discord) / EU, Germany (n8n Cloud) |
| Anthropic, FASHN | Role: assisted writing of product pages and virtual try-on: no User data transmitted — Location: United States |
Transfers outside the European Union are governed by the European Commission's standard contractual clauses or by the Data Privacy Framework. Data may be disclosed to the authorities upon official request (réquisition) and to Segna's legal advisers in the event of litigation.
5. Retention periods
| Data | Period |
|---|---|
| Account, profile, content | as long as the account is active, then erased on deletion or after 3 years of inactivity |
| Orders, invoices, payments | 10 years (accounting obligations), pseudonymised after account deletion |
| Disputes, compensation, formal notices | 5 years from closure (limitation period) |
| Identity verification result | duration of the Club+ membership, then 1 year |
| Residual data after account deletion | permanently purged within 6 months |
| Connection logs and sessions | 1 year |
| Consents and communication preferences | 3 years after the last contact |
| Cookies and trackers | 13 months maximum; audience data 25 months |
| Chat messages relayed on Discord | thread deleted 12 hours after the conversation is closed |
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time and the right to set instructions regarding your data after your death (directives post mortem). Most of these rights can be exercised directly in the app (settings, privacy preferences, account deletion); for anything else, write to privacy@segnashare.com. Segna replies within one month. You may lodge a complaint with the CNIL (French data protection authority, www.cnil.fr).
Communication preferences: service messages cannot be switched off; marketing e-mails and notifications can be switched off in the settings or via the unsubscribe link. Notifications observe a quiet period from 9 pm to 9 am.
7. Cookies and trackers
On the website, a banner (Cookiebot) collects your consent before any non-essential tracker is placed. The categories are set out in the Cookie policy. In the app, Segna uses PostHog to measure usage and improve the service; you can object to this by writing to privacy@segnashare.com.
8. Security
Data is encrypted in transit, hosted with certified service providers, and protected by per-user access rules (row level security) and audit logs. Card data never passes through Segna. In the event of a data breach presenting a risk, Segna informs the CNIL within 72 hours, as well as the data subjects concerned.
9. Minors
The Platform is reserved for persons of legal age. Segna deletes any account that appears to belong to a minor.
10. Changes
Segna may update this policy; the version date appears at the top. Any substantial change is notified by e-mail or in the app.